createuser => insufficient_permission error

[toshi-studio]

Hi !

I am starting a project using symfony (latest) and kreait/firebase-php (latest I guess)
When I call the method createUser from Auth, I get an INSUFFICIENT_PERMISSION error which I can't determine the reason. Any advice or tip would be greatly appreciated
As you may see below, I really tried to figure it out by myself but I am a complete stranger to the Google Cloud Platform and I am completely in the dark using their console :)

Details

The dependencies as in the composer.json file

"kreait/firebase-bundle": "^2.4",
"kreait/firebase-php": "^5.18",

I checked that the following APIs are enabled

• Firebase Cloud Messaging API
• Firebase Dynamic Links API
• Firebase Hosting AP
• Firebase Installations API
• Firebase Management API
• Firebase Realtime Database Management API
• Firebase Remote Config API
• Firebase Rules API

The service account has the owner role of the project

The JSON file downloaded when I created the key for my project looks like

{
  "type": "service_account",
  "project_id": "****",
  "private_key_id": "****",
  "private_key": "-----BEGIN PRIVATE KEY----- =\n-----END PRIVATE KEY-----\n",
  "client_email": "***@***.iam.gserviceaccount.com",
  "client_id": "****",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/****%40****.iam.gserviceaccount.com"
}

The config/bundles.php has the firebase bundle declaration

Kreait\Firebase\Symfony\Bundle\FirebaseBundle::class => ['all' => true],

The config/packages/firebase.yaml has the credentials set

kreait_firebase:
  projects:
    test:
      credentials: '%kernel.project_dir%/config/*******.json'
      default: true

The code

namespace App\Service;

use App\Entity\User;
use Kreait\Firebase\Auth;
use Kreait\Firebase\Exception\AuthException;
use Kreait\Firebase\Exception\FirebaseException;

class UserService
{
    private Auth $auth;

    public function __construct(Auth $auth)
    {
        $this->auth = $auth;
    }

    /**
     * Creates an email/password firebase user
     * @param User $user
     */
    public function createUser(User $user) {
        $userProperties = [
            'email' => $user->getEmail(),
            'password' => $user->getPassword(),
            'displayName' => $user->getDisplayName(),
        ];
        try {
            $createdUser = $this->auth->createUser($userProperties);
            dd($createdUser);
        } catch (AuthException | FirebaseException $e) {
            dd($e);
        }
    }
}

The error

UserService.php on line 29:
Kreait\Firebase\Exception\Auth\AuthError {#536 ▼
  #message: "INSUFFICIENT_PERMISSION"
  #code: 400
  #file: "C:\dev\....\source\vendor\kreait\firebase-php\src\Firebase\Exception\AuthApiExceptionConverter.php"
  #line: 134
  -previous: GuzzleHttp\Exception\ClientException {#508 ▶}
  trace: {▼
    C:\dev\....\source\vendor\kreait\firebase-php\src\Firebase\Exception\AuthApiExceptionConverter.php:134 {▶}
    C:\dev\....\source\vendor\kreait\firebase-php\src\Firebase\Exception\AuthApiExceptionConverter.php:50 {▶}
    C:\dev\....\source\vendor\kreait\firebase-php\src\Firebase\Auth\ApiClient.php:221 {▶}
    C:\dev\....\source\vendor\kreait\firebase-php\src\Firebase\Auth\ApiClient.php:51 {▶}
    C:\dev\....\source\vendor\kreait\firebase-php\src\Firebase\Auth.php:145 {▶}
    C:\dev\....\source\src\Service\UserService.php:26 {▶}
    C:\dev\....\source\src\Controller\RegisterController.php:78 {▶}
    C:\dev\....\source\vendor\symfony\http-kernel\HttpKernel.php:157 {▶}
    C:\dev\....\source\vendor\symfony\http-kernel\HttpKernel.php:79 {▶}
    C:\dev\....\source\vendor\symfony\http-kernel\Kernel.php:195 {▶}
    C:\dev\....\source\public\index.php:20 {▶}
  }
}

[jeromegamez]

Hi 👋, and thanks for the detailed description!

Can you confirm that the Email/Password user provider is enabled at https://console.firebase.google.com/project/_/authentication/providers? 🤞

[jeromegamez]

And there goes my hope for a quick solution 😂.

If you haven't already, please try…

• Hardcoding the values for email (must not already exist), password (must be cleartext and at least 6 characters), and display name, just to be sure that the issue is not related to the input values.
• Generating a new private key on https://console.firebase.google.com/project/beste-firebase/settings/serviceaccounts/adminsdk - there have been reports in the past that the original key didn't really have all needed permissions, or, if the key was generated/modified via the GCP console.

🤞

[toshi-studio]

No luck, same error. I used a brand new json file and the hardcoded data were

$userProperties = [
    'email' => '[email protected]',
    'password' => 'Test123456',
    'displayName' => 'Toshi',
 ];

PS : it's 2.40am here. So I'll get some rest and try again later. Maybe with a fresh head... Thank you for your time! 🙏

[jeromegamez]

What a coincidence, it's the same time here as well 😅.

Unfortunately, the official docs also say that it's most likely something with the Service Account permissions (auth/insufficient-permission on https://firebase.google.com/docs/auth/admin/errors?hl=en)

I'm out of ideas for the moment, but perhaps something comes to mind tomorrow... nightynight! 💤

[toshi-studio]

Hi again !
I figured out the problem and, as we suspected, it was a permission problem.

SOLUTION

I added the owner role to the service account in the IAM tab
The previously mentioned role (in my problem description) was in the Service Account tab

@jeromegamez Again, I thank you a lot for your help and tips which lead me to the solution

[jeromegamez]

You're very welcome, another successful rubber duck debugging session 💪😅! (And thank you for the generous coffee 🥰☕)